Atom-oh · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -25,7 +25,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- Web framework and runtime refresh: Next.js 16.4.5, React 19.3.1 and Node 26.13.0 retain authentication, ownership checks and standalone deployment; the request body guard uses the Next.js proxy convention. Refresh JavaScript/Python dependencies and AgentCore SDKs with compatibility pins, Terraform 1.17.1/provider locks, and Python 3.14 Lambda/container runtimes. The documentation guide builds and deploys on Node 26. Preserve gateway authentication, feature gates and release safeguards.
+- Web framework and runtime refresh: Next.js 16.4.5, React 19.3.1 and Node 26.13.0 retain authentication, ownership checks and standalone deployment; the request body guard uses the Next.js proxy convention. Refresh JavaScript/Python dependencies and AgentCore SDKs with compatibility pins, Terraform 1.17.1/provider locks, and Python 3.14 Lambda/container runtimes. The documentation guide builds and deploys on Node 26 with refreshed documentation security dependencies and Mermaid 12, preserving all four locales. Preserve gateway authentication, feature gates and release safeguards.
 - Bedrock models: chat, AI Diagnosis, routing, synthesis and the background workers move to Claude Sonnet 5.5, Opus 5.5 (AI Diagnosis Deep tier option) and Haiku 5.5. These models reject `temperature`, so requests no longer send it. Haiku calls and Sonnet calls with fixed output caps run without extended thinking so existing budgets still fit (the chat agent keeps adaptive thinking, as on Sonnet 5); Opus 5.5, which always thinks, gets extra output headroom for Deep report sections and invariant proposals. The web task's classifier and synthesis IAM grants must allow the 5.5 models before this release rolls out.
 
 ### Fixed
@@ -699,7 +699,7 @@ First release of the **v2 line** (versioned independently from the v1 1.x line,
 
 ### Changed
 
-- 웹 프레임워크·런타임 최신화: Next.js 16.4.5, React 19.3.1, Node 26.13.0으로 인증·소유권 검사·standalone 배포를 유지하고 요청 본문 제한을 Next.js proxy 규약으로 옮깁니다. 호환성 버전 고정과 함께 JavaScript/Python 의존성·AgentCore SDK, Terraform 1.17.1·provider 잠금파일, Python 3.14 Lambda·컨테이너 런타임을 갱신합니다. 문서 가이드는 Node 26에서 빌드·배포합니다. Gateway 인증·기능 게이트·릴리스 보호 장치는 유지합니다.
+- 웹 프레임워크·런타임 최신화: Next.js 16.4.5, React 19.3.1, Node 26.13.0으로 인증·소유권 검사·standalone 배포를 유지하고 요청 본문 제한을 Next.js proxy 규약으로 옮깁니다. 호환성 버전 고정과 함께 JavaScript/Python 의존성·AgentCore SDK, Terraform 1.17.1·provider 잠금파일, Python 3.14 Lambda·컨테이너 런타임을 갱신합니다. 문서 가이드는 Node 26에서 빌드·배포하며 문서 사이트의 보안 의존성과 Mermaid 12를 갱신하고 4개 언어를 유지합니다. Gateway 인증·기능 게이트·릴리스 보호 장치는 유지합니다.
 - Bedrock 모델: 채팅, AI 진단, 라우팅, 합성, 백그라운드 워커가 Claude Sonnet 5.5, Opus 5.5(AI 진단 Deep 단계 선택), Haiku 5.5로 바뀝니다. 이 모델들은 `temperature`를 거부하므로 요청에서 더 이상 보내지 않습니다. Haiku 호출과 출력 상한이 고정된 Sonnet 호출은 기존 상한이 유지되도록 확장 사고 없이 실행하고(채팅 에이전트는 Sonnet 5 때처럼 adaptive 사고 유지), 항상 사고하는 Opus 5.5는 Deep 리포트 섹션과 불변식 제안에 출력 여유분을 더 받습니다. 웹 태스크의 분류기·합성 IAM 권한이 이 릴리스 배포 전에 5.5 모델을 허용해야 합니다.
 
 ### 수정

diff --git a/README.md b/README.md
@@ -27,7 +27,7 @@ AWSops v2 is a single-pane operations dashboard for AWS and Kubernetes, rebuilt
 
 ```
 Internet -> CloudFront (TLS, Lambda@Edge Cognito auth) -> VPC Origin (https-only) -> internal ALB (HTTPS)
-  -> ECS Fargate: Next.js 15 thin-BFF :3000 (arm64, no basePath) -> Aurora Serverless v2 (PG 17.9, node-pg)
+  -> ECS Fargate: Next.js 16 thin-BFF :3000 (arm64, no basePath) -> Aurora Serverless v2 (PG 17.9, node-pg)
   -> Amazon Bedrock AgentCore: Runtime (Strands) + 9 section Gateways + Memory + Code Interpreter
   -> async workers: POST /api/jobs -> SQS -> Step Functions -> Lambda or Fargate worker
 ```
@@ -178,7 +178,7 @@ AgentCore's own config (runtime ARN, Memory ID, Code Interpreter ID) is written
 
 ```
 awsops/
-  web/                    # Next.js 15 thin-BFF: 41 pages, 104 API routes, 118 components
+  web/                    # Next.js 16 thin-BFF: 41 pages, 104 API routes, 118 components
   agent/                  # Strands Agent (Runtime source) + MCP Lambda tool sources
   terraform/foundation/  # single Terraform root: network, edge, auth, data, workload, ai, workers, eks
   scripts/v2/             # configure/deploy/migrate/agentcore/workers tooling (all Node.js/Python)
@@ -190,6 +190,7 @@ awsops/
 ## Testing
 
 Install the dependencies listed in [merge verification](docs/v2-merge-verification.md#runner-usage).
+JavaScript builds and tests require Node 26.13.0 and npm 11.12.1 or newer within Node 26.
 Docker and prepared `AWSOPS_REVIEW_CODEC_STATE` are also required; use the [sandbox setup](docs/runbooks/review-codec-sandbox.md#verification).
 
 Image fixtures, including the panel-prompt structure check in `tests/run-all.sh`, require
@@ -202,8 +203,8 @@ The required migration, web connection-phase and agent tool-policy history Postg
 they use bare `docker` on PATH (the documented exceptions to optional legacy itests).
 The web connection and policy suites also require `npm ci --prefix web` for the locked driver and TypeScript.
 These suites and their offline companion use no AWS credentials.
-Authenticated deployment smoke tests require curl, OpenSSL, Python 3 with PyYAML and Terraform **1.15.7**;
-their offline variable fixture needs no providers. Terraform mock tests require **1.15.7** and installed/cached
+Authenticated deployment smoke tests require curl, OpenSSL, Python 3 with PyYAML and Terraform **1.17.1**;
+their offline variable fixture needs no providers. Terraform mock tests require **1.17.1** and installed/cached
 providers; the helper copies only tracked working-tree files, runs `init -backend=false`, validates
 and tests without a real backend. Missing deployment-suite prerequisites fail the shared runner;
 only its final fmt/validate diagnostics are informational.
@@ -226,7 +227,7 @@ bash tests/run-all.sh             # repo-wide hook/structure tests + agent Pytho
 ```
 
 The private migration fixture command includes runtime, controller, workflow and mocked-plan
-checks. Controller/workflow checks also require Python 3 with PyYAML, boto3/botocore (`pip install -r agent/requirements.txt`) and Terraform **1.15.7**.
+checks. Controller/workflow checks also require Python 3 with PyYAML, boto3/botocore (`pip install -r agent/requirements.txt`) and Terraform **1.17.1**.
 See [merge verification](docs/v2-merge-verification.md) for the complete CI scope,
 including the conditional documentation build and full presentation archive check.
 
@@ -269,7 +270,7 @@ AWSops v2는 AWS와 Kubernetes를 위한 단일 화면 운영 대시보드로, T
 
 ```
 Internet -> CloudFront (TLS, Lambda@Edge Cognito 인증) -> VPC Origin (https-only) -> 내부 ALB (HTTPS)
-  -> ECS Fargate: Next.js 15 thin-BFF :3000 (arm64, basePath 없음) -> Aurora Serverless v2 (PG 17.9, node-pg)
+  -> ECS Fargate: Next.js 16 thin-BFF :3000 (arm64, basePath 없음) -> Aurora Serverless v2 (PG 17.9, node-pg)
   -> Amazon Bedrock AgentCore: Runtime (Strands) + 9 섹션 Gateway + Memory + Code Interpreter
   -> 비동기 워커: POST /api/jobs -> SQS -> Step Functions -> Lambda 또는 Fargate 워커
 ```
@@ -415,7 +416,7 @@ AgentCore 자체 설정(runtime ARN, Memory ID, Code Interpreter ID)은 provisio
 
 ```
 awsops/
-  web/                      # Next.js 15 thin-BFF: 41 페이지, 104 API 라우트, 118 컴포넌트
+  web/                      # Next.js 16 thin-BFF: 41 페이지, 104 API 라우트, 118 컴포넌트
   agent/                    # Strands Agent(Runtime 소스) + MCP Lambda 도구 소스
   terraform/foundation/  # 단일 Terraform 루트: network, edge, auth, data, workload, ai, workers, eks
   scripts/v2/               # configure/deploy/migrate/agentcore/workers 도구(전부 Node.js/Python)
@@ -427,6 +428,7 @@ awsops/
 ## 테스트
 
 [머지 검증](docs/v2-merge-verification.md#runner-usage)의 의존성을 먼저 설치하세요.
+JavaScript 빌드·테스트에는 Node 26 계열의 Node 26.13.0 이상과 npm 11.12.1 이상이 필요합니다.
 Docker와 준비된 `AWSOPS_REVIEW_CODEC_STATE`도 필요합니다. [샌드박스 준비 절차](docs/runbooks/review-codec-sandbox.md#verification)를 따르세요.
 
 `tests/run-all.sh`의 panel-prompt 구조 검사를 포함한 이미지 fixture에는 Linux ARM64/x86-64의
@@ -439,9 +441,9 @@ Private migration 테스트는 `npm ci --prefix scripts/v2 --ignore-scripts --no
 Docker 부재 시 gate가 실패하고 PATH의 `docker`를 직접 사용합니다. 웹 연결·정책 테스트는 잠긴 드라이버와
 TypeScript를 위해 `npm ci --prefix web`도 필요합니다. 이 테스트들과 오프라인 companion은
 AWS 자격증명을 사용하지 않습니다.
-인증 배포 smoke 테스트는 curl·OpenSSL·Python 3·PyYAML·Terraform **1.15.7**을 필수로 요구하며,
+인증 배포 smoke 테스트는 curl·OpenSSL·Python 3·PyYAML·Terraform **1.17.1**을 필수로 요구하며,
 누락 시 공통 러너도 실패합니다. 오프라인 변수 fixture에는 provider가 필요하지 않습니다.
-마지막 fmt/validate 진단만 참고용입니다. Terraform mock 테스트에는 **1.15.7**과
+마지막 fmt/validate 진단만 참고용입니다. Terraform mock 테스트에는 **1.17.1**과
 설치/캐시된 provider가 필요합니다. 도우미는 추적된
 작업 파일만 복사해 `init -backend=false`, validate, test를 실행하며 실제 backend를 사용하지 않습니다.
 필수 `test_ci_web_read.py`·`test_ci_web_deploy.py` 테스트는 Python 3.12와 Linux `/proc`, POSIX 프로세스 그룹, `os.geteuid`가 필요하며 외부 provider를 모의하므로 AWS CLI·gh·curl·jq를 실행하지 않습니다. 필수 `test_ci_web_workflow.py` 테스트에는 PyYAML과 Bash도 필요합니다. Deploy Web은 컨트롤러를 사용하고 웹 배포가 호출하는 마이그레이션에 자동 SQL 검사를 강제합니다. 자세한 내용은 `docs/runbooks/release-safety-primitives.md`를 참고하세요.
@@ -463,7 +465,7 @@ bash tests/run-all.sh             # repo 전반 hook/structure 테스트 + agent
 ```
 
 위 private migration fixture 명령은 runtime·controller·workflow·모의 계획 검사를 포함합니다.
-controller/workflow 검사에는 Python 3·PyYAML·boto3/botocore (`pip install -r agent/requirements.txt`)·Terraform **1.15.7**도 필요합니다.
+controller/workflow 검사에는 Python 3·PyYAML·boto3/botocore (`pip install -r agent/requirements.txt`)·Terraform **1.17.1**도 필요합니다.
 조건부 문서 빌드와 프레젠테이션 전체 아카이브 검증을 포함한 CI 범위는
 [머지 검증 가이드](docs/v2-merge-verification.md)를 참고하세요.
 

diff --git a/docs-site/README.md b/docs-site/README.md
@@ -28,7 +28,7 @@ This command generates static content into the `build` directory and can be serv
 
 ## Dependency validation
 
-Use Node.js 20 or later and npm so `package-lock.json` and the security overrides
+Use Node.js 26 (`engines`: `>=26.13.0 <27`) and npm so `package-lock.json` and the security overrides
 in `package.json` are applied. The presentation check uses the Linux tools available
 in CI: Bash, GNU coreutils/grep/sed, unzip and Python 3. For dependency updates, run:
 

diff --git a/docs-site/docs/faq/architecture.md b/docs-site/docs/faq/architecture.md
@@ -164,7 +164,7 @@ flowchart LR
 
 ### 단계별 상세
 
-**1. Lambda@Edge (us-east-1, python3.12, Viewer Request)**
+**1. Lambda@Edge (us-east-1, python3.14, Viewer Request)**
 - 모든 요청에서 `awsops_token` 쿠키의 JWT를 **RS256 JWKS로 서명 검증** + `iss`/`aud`/`token_use` 확인.
 - 미인증이면 자체 **`/login`** 폼으로 redirect.
 

diff --git a/docs-site/docs/getting-started/auth.md b/docs-site/docs/getting-started/auth.md
@@ -48,7 +48,7 @@ AWSops는 Amazon Cognito + Lambda@Edge + CloudFront 조합으로 인증을 처
 | 항목 | 설정 |
 |------|------|
 | **리전** | us-east-1 (Lambda@Edge 필수) |
-| **런타임** | Python 3.12 (배포 핸들러; CDK 스텁은 Node.js 20) |
+| **런타임** | Python 3.14 (배포 핸들러; CDK 스텁은 Node.js 20) |
 | **트리거** | CloudFront viewer-request |
 | **기능** | `awsops_token` JWT 쿠키 검증, 미인증 시 `/awsops/login` 리다이렉트 |
 

diff --git a/docs-site/hyperframes/product-tour/README.md b/docs-site/hyperframes/product-tour/README.md
@@ -6,12 +6,12 @@ Source for the docs-site landing hero video: `docs-site/static/video/product-tou
 
 ## Why this exists as committed binaries
 
-The GitHub Pages build (`.github/workflows/deploy-guide.yml`) runs on Node 20 with no ffmpeg, and the HyperFrames CLI requires Node ≥22 + ffmpeg. CI cannot render this. The mp4/webp are committed static assets; re-render locally when the product UI changes enough to make the tour stale (roughly: a redesign of dashboard/assistant/topology/diagnosis, or a refresh of the underlying `static/showcase/media/*.webp` set).
+The GitHub Pages build (`.github/workflows/deploy-guide.yml`) has no ffmpeg, and the HyperFrames CLI requires ffmpeg (and Node ≥22). CI cannot render this. The mp4/webp are committed static assets; re-render locally when the product UI changes enough to make the tour stale (roughly: a redesign of dashboard/assistant/topology/diagnosis, or a refresh of the underlying `static/showcase/media/*.webp` set).
 
 ## Toolchain (one-time, no sudo)
 
 ```bash
-# Node >=22 (this repo's default runner has Node 20)
+# Node >=22 for the HyperFrames CLI (the repository itself uses Node 26)
 curl -fL -o /tmp/node22.tar.xz https://nodejs.org/dist/v22.18.0/node-v22.18.0-linux-arm64.tar.xz
 tar xf /tmp/node22.tar.xz -C /tmp
 mv /tmp/node-v22.18.0-linux-arm64 ~/.local/node22

diff --git a/docs-site/i18n/en/docusaurus-plugin-content-docs/current/faq/architecture.md b/docs-site/i18n/en/docusaurus-plugin-content-docs/current/faq/architecture.md
@@ -164,7 +164,7 @@ flowchart LR
 
 ### Step by step
 
-**1. Lambda@Edge (us-east-1, python3.12, Viewer Request)**
+**1. Lambda@Edge (us-east-1, python3.14, Viewer Request)**
 - On every request, verifies the `awsops_token` JWT with **RS256 JWKS** + checks `iss`/`aud`/`token_use`.
 - Unauthenticated requests are redirected to the self-hosted **`/login`** form.
 

diff --git a/docs-site/i18n/en/docusaurus-plugin-content-docs/current/getting-started/auth.md b/docs-site/i18n/en/docusaurus-plugin-content-docs/current/getting-started/auth.md
@@ -48,7 +48,7 @@ AWSops handles authentication using Amazon Cognito + Lambda@Edge + CloudFront.
 | Item | Setting |
 |------|---------|
 | **Region** | us-east-1 (required for Lambda@Edge) |
-| **Runtime** | Python 3.12 (deployed handler; CDK stub is Node.js 20) |
+| **Runtime** | Python 3.14 (deployed handler; CDK stub is Node.js 20) |
 | **Trigger** | CloudFront viewer-request |
 | **Functions** | JWT validation, OAuth2 callback handling, cookie management |
 

diff --git a/docs-site/i18n/ja/docusaurus-plugin-content-docs/current/faq/architecture.md b/docs-site/i18n/ja/docusaurus-plugin-content-docs/current/faq/architecture.md
@@ -164,7 +164,7 @@ flowchart LR
 
 ### ステップごとの詳細
 
-**1. Lambda@Edge（us-east-1、python3.12、Viewer Request）**
+**1. Lambda@Edge（us-east-1、python3.14、Viewer Request）**
 - すべてのリクエストで `awsops_token` クッキーの JWT を **RS256 JWKS で署名検証** + `iss`/`aud`/`token_use` を確認。
 - 未認証であれば自前の **`/login`** フォームへ redirect。
 

diff --git a/docs-site/i18n/ja/docusaurus-plugin-content-docs/current/getting-started/auth.md b/docs-site/i18n/ja/docusaurus-plugin-content-docs/current/getting-started/auth.md
@@ -48,7 +48,7 @@ AWSops は Amazon Cognito + Lambda@Edge + CloudFront の組み合わせで認証
 | 項目 | 設定 |
 |------|------|
 | **リージョン** | us-east-1 (Lambda@Edge の必須要件) |
-| **ランタイム** | Python 3.12 (デプロイハンドラー; CDK スタブは Node.js 20) |
+| **ランタイム** | Python 3.14 (デプロイハンドラー; CDK スタブは Node.js 20) |
 | **トリガー** | CloudFront viewer-request |
 | **機能** | `awsops_token` JWT Cookie の検証、未認証時は `/awsops/login` へリダイレクト |
 

diff --git a/docs-site/i18n/zh/docusaurus-plugin-content-docs/current/faq/architecture.md b/docs-site/i18n/zh/docusaurus-plugin-content-docs/current/faq/architecture.md
@@ -164,7 +164,7 @@ flowchart LR
 
 ### 逐步详情
 
-**1. Lambda@Edge（us-east-1，python3.12，Viewer Request）**
+**1. Lambda@Edge（us-east-1，python3.14，Viewer Request）**
 - 对每个请求都通过 **RS256 JWKS 签名校验** `awsops_token` Cookie 中的 JWT，并检查 `iss`/`aud`/`token_use`。
 - 未认证则重定向到自托管的 **`/login`** 表单。
 

diff --git a/docs-site/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/auth.md b/docs-site/i18n/zh/docusaurus-plugin-content-docs/current/getting-started/auth.md
@@ -48,7 +48,7 @@ AWSops 通过 Amazon Cognito + Lambda@Edge + CloudFront 组合处理认证。
 | 项目 | 设置 |
 |------|------|
 | **区域** | us-east-1（Lambda@Edge 必需） |
-| **运行时** | Python 3.12（部署处理程序；CDK 存根为 Node.js 20） |
+| **运行时** | Python 3.14（部署处理程序；CDK 存根为 Node.js 20） |
 | **触发器** | CloudFront viewer-request |
 | **功能** | 验证 `awsops_token` JWT Cookie，未认证时重定向到 `/awsops/login` |